Access to NHS Records transferred to places of deposit under the Public Records Act Contents Access to NHS Records transferred to places of deposit under the Public Records Act ..................................................................................................... 1 1 Introduction ........................................................................................................... 5 1.1 What is the purpose of this guidance? ........................................................ 5 1.2 Who is this guidance for? ........................................................................ 5 1.3 Abbreviations and terms used in this guidance ....................................... 5 2 Statutory background .......................................................................................... 6 2.1 Public Records Act 1958 ........................................................................ 6 2.2 Previous access regime ........................................................................ 6 2.3 Current access regime ........................................................................... 6 2.4 Other legal factors affecting access ....................................................... 7 2.5 Non-applicability of certain legislation to transferred public records ... 8 3 Processing access requests .............................................................................. 8 3.1 Summary ..................................................................................................... 8 3.2 Allocation of responsibilities ................................................................... 8 3.3 Responses .................................................................................................. 9 3.4 Data Protection Act (s40 exemption) ....................................................... 10 3.5 Determining the ‘responsible authority’ ................................................ 10 4 Establishing procedures for consultation ....................................................... 11 4.1 Places of deposit based in NHS Organisations ..................................... 11 4.2 Records already held for operational purposes ..................................... 11 4.3 Consultation under Data Protection Act 1998 ....................................... 12 4.4 Sensitivity review on transfer ................................................................. 12 5 Designation of records as ‘open’ ..................................................................... 12 5.1 General considerations .......................................................................... 12 5.2 Application of existing ‘closure’ periods .............................................. 14 5.3 Retrospective ‘closure’ of records .......................................................... 15 5.4 Updating public information about access ........................................... 15 6 Release of information to specific individuals other than under Freedom of Information Act ........................................................................................... 15 6.1 General considerations .......................................................................... 15 6.2 Release of Information under Data Protection Act 1998 ....................... 16 6.3 Exemptions to access rights under Data Protection Act ....................... 17 6.4 Release under other statutory provisions ............................................. 17 6.5 Voluntary release of Information outside the terms of Freedom of Information Act ........................................................................................... 18 7 Applying exemption: working assumptions .................................................... 18 7.1 Background ............................................................................................. 18 7.2 General assumptions ............................................................................. 19 7.3 General administrative information ....................................................... 20 7.3.1 Scope ............................................................................................. 20 7.3.2 Working assumption ..................................................................... 20 7.3.3 Exceptions ................................................................................... 20 7.3.4 Discussion .................................................................................. 20 7.4 Information about identifiable living patients ......................................... 21 7.4.1 Scope ............................................................................................. 21 7.4.2 Working assumption ..................................................................... 21 7.4.3 Significant exceptions .................................................................. 22 7.4.4 Discussion .................................................................................. 23 1 Introduction

1.1 What is the purpose of this guidance?

NHS Trusts have a duty to select and transfer those of their records which have permanent value to the National Archives or an appointed place of deposit at or before they reach 30 years old(^1). The statutory regime for public access to these transferred records has been substantially altered following the entering into force of the Freedom of Information Act 2000.

The purpose of this guidance is to assist NHS Trusts and places of deposit in carrying out their respective duties under this new statutory access regime. It also addresses closely related issues in the management of transferred NHS public records.

This guidance has been developed in consultation with Department of Health and the UK Information Commissioner’s Office.

1.2 Who is this guidance for?

Local NHS organisations, including hospitals, Trusts and Foundation Trusts particularly staff, such as corporate and health records managers, Caldicott Guardians, Freedom of Information and Data Protection officers.

Organisations responsible for Places of Deposit appointed to hold records of NHS organisations under s4(1) of the Public Records Act 1958 particularly staff with roles primarily concerned with information governance or with managing or providing access services in respect of records held under the Act.

1.3 Abbreviations and terms used in this guidance

| Abbreviation | Description | |--------------|-------------| | EIR | Environmental Information Regulations | | PoD | Place of Deposit | | LCI | Lord Chancellor’s Instrument | | FOIA | Freedom of Information Act 2000 | | DPA | Data Protection Act 1998 | | PIT | public interest test | | NHS | National Health Service | | PRA | Public Records Act 1958 | | s | section |

In this guidance, ‘patient’ includes not only persons using NHS services for medical treatment, but also persons involved with the NHS in respect of related purposes such as screening or research.

(^1) This period was amended to 20 years by s.45 of the Constitutional Reform and Governance Act 2010, but the introduction of the change is subject to transitional arrangements. 2 Statutory background

2.1 Public Records Act 1958

(Note: this Act refers to the ‘Public Record Office’ and ‘The Keeper of Public Records’: although these statutory titles continue to exist, since 2003, these have commonly been referred to as ‘The National Archives’ and the ‘Chief Executive of The National Archives’ respectively)

Under Schedule 1 of the Act(^2), NHS Trusts are designated as public records bodies. Section 3(1) places a duty on such bodies to select such of their records as are worthy of permanent preservation, and to transfer these to The National Archives or to a ‘place of deposit’ appointed under section 4 (1) at or before they reach 30 years old, calculated from the last date on the record unit(^3) unless an LCI under s3(4) of PRA applies. This period was amended to 20 years by s45 of the Constitutional Reform and Governance Act 2010(^4), but the introduction of the change is subject to transitional arrangements This duty is to be carried out under the supervision of The National Archives, which is effected through guidance issued in consultation with the Department of Health, and through the appropriate PoD.

2.2 Previous access regime

Before January 2005, The National Archives and PoDs had a statutory duty to make transferred records available for public inspection once a physical file unit (file, register etc) reached 30 years old, measured from the latest recorded date, unless there was a Lord Chancellor’s Instrument (LCI) specifying an alternative period.

LCI 92 specified a period of 100 years for NHS records containing information relating to the health of identifiable patients. Record units more recent than this were generally referred to as ‘closed’ and access was at the discretion of the NHS body which had transferred them to the place of deposit, subject to any other relevant legal provisions (often referred to as ‘privileged access’).

2.3 Current access regime

In January 2005, these access provisions were effectively replaced when s67 and Schedule 5 of the Freedom of Information Act 2000 (FOIA)(^5) amended the Public Records Act.

The system of ‘closure periods’ (including the extended closure implemented by LCI 92) and ‘privileged access’ has ceased to have statutory effect. The duty to give access under section 5(3) of PRA now relates to information in transferred public records ‘which fall to be disclosed in accordance with Freedom of Information Act

(^2) [www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/1958/cukpga_19580051_en_1](http://www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/1958/cukpga_19580051_en_1)

(^3) The same basis of calculation applies through FOIA s62(2): note that this may differ from the date at which NHS bodies may consider that records have been ‘closed’ (ie that no further or additions will be made to them).

(^4) [www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/2010/cukpga_20100025_en_1](http://www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/2010/cukpga_20100025_en_1)

(^5) [www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/2000/cukpga_20000036_en_1](http://www.opsi.gov.uk/RevisedStatutes/Acts/ukpga/2000/cukpga_20000036_en_1) 2000’ which is now the main legislation controlling access. However, as a condition of appointment PoDs are expected to actively promote public access beyond the basic provisions of FOIA.

Some NHS records may also contain environmental information, as defined by the Environmental Information Regulations 2004 (notably regulation 2(1)(f) ‘…the state of human health and safety…in as much as they are or may be affected…by the state of the elements of the environment’). Slightly different, provisions apply to such information. In this guidance, references to FOIA, and exemptions to FOIA, will also apply to EIR, and exceptions to access under them unless specifically stated to the contrary.

FOIA provides a general right of access to information held by public authorities, subject to a number of exemptions. Even where a possible exemption exists, FOIA does not require it to be applied, although there will normally be good reasons to do so. Unlike PRA, FOIA and EIR apply to information, not the physical records in which it is contained, and limitations on access (exemptions or exceptions) are now based primarily on the nature of the information, rather than its age.

General guidance on the interaction of FOIA and PRA is available at:

http://www.nationalarchives.gov.uk/archives/foiguide.htm

Only those aspects most relevant to transferred NHS public records are described here.

2.4 Other legal factors affecting access

A variety of other legal factors affecting access to transferred public records, are given effect through the application of Freedom of Information Act exemptions, notably:

- Data Protection Act 1998 (section 40 exemption)
- The Environmental Information Regulations (section 74 and section 39 exemption)
- common law of confidence (section 41)

Human Rights Act should normally be taken into account through its effect on the interpretation of these other legal provisions, rather than directly as a statute bar (section 44 exemption) in its own right.

______________________________________________________________________

6 General guidance on the implementation of the Freedom of Information Act can be obtained from the Information Commissioner and Ministry of Justice: www.ico.gov.uk www.justice.gov.uk/guidance/guidance.htm

General guidance on EIR is available from: www.defra.gov.uk/corporate/policy/opengov/eir/index.htm

7 Following the approach of the Information Tribunal in: www.informationtribunal.gov.uk/Documents/decisions/mrspluckvinformationcommissioner(17sept2007).pdf 2.5 Non-applicability of certain legislation to transferred public records

A number of statutes and regulations affecting access to NHS records no longer have effect once they have transferred to a place of deposit. Most notably, the Access to Health Records Act 1990, which provides additional access rights to the health records of deceased patients for certain specified categories of persons, applies to such records while held by or on behalf of health professionals. However, in practice, similar provision can be made through the application of FOIA exemptions.

3 Processing access requests

3.1 Summary

- Primary responsibility for responding to requests for transferred records (whether under FOIA, DPA or EIR) lies with the PoD, which acts on behalf of the Lord Chancellor, by virtue of its appointment under PRA.
- The PoD must consult the NHS Trust when processing FOI or EIR requests.
- The Trust has a duty to carry out public interest tests where necessary.
- When processing DPA subject access requests the PoD must consult the ‘appropriate medical professional’ in the Trust who will determine whether information should be withheld due to possible ‘serious harm’
- The PoD holds transferred records ‘on behalf of’ the Lord Chancellor under PRA, and is data controller for most purposes under DPA. However, the NHS Trust is also data controller in respect of certain processing (notably processing of subject access requests) as above.
- The National Archives will provide advice and guidance, including reference to the Lord Chancellor if there is doubt over which NHS Trust is the ‘responsible authority’, in consultation with Department of Health
- Timescale for responses is 30 working days (FOI, EIR) or 40 calendar days (DPA), but ‘reasonable’ additional time is allowed for PIT’s.

3.2 Allocation of responsibilities

- Before 2005, records’ status as ‘open’ or ‘closed’ was determined directly by statute (ie PRA) or by an LCI issued under it by the Lord Chancellor in accordance with the date and type of the record units concerned. Access to ‘closed’ records was at the discretion of the transferring organisation. • Section 15 of FOIA now defines roles and responsibilities. The PoD ‘holds’ NHS records transferred to it by virtue of its appointment by the Lord Chancellor in terms of section 1 of FOIA.(^8)

• Decisions on access to transferred NHS records under FOIA are now made jointly by PoDs, acting on behalf of the Lord Chancellor as the ‘appropriate records authority’ under section 15(5) of FOIA, and the appropriate NHS Trust (normally the transferring NHS organisation, see below) as ‘responsible authority’.

3.3 Responses

When responding to any request for information which is, or may be, contained in records which are not ‘open’ the PoD must assess whether the information is covered by a FOIA exemption and respond to the applicant.

When doing so, section 66 of FOIA requires that the PoD also consults the ‘responsible authority’ designated under section 15(5). The form of consultation is not specified in the Act, so there is scope for local decision. As a minimum, however, the NHS Trust must receive sufficient timely information to enable it to make representations to the PoD if it wishes to do so, and, it should do so sufficiently promptly to enable the PoD to take account of these while responding to the applicant within the statutory timescales.

Where PoDs and NHS Trusts have reached an agreed approach to common access scenarios, it may be sufficient for the PoD to inform the Trust through a simple exchange of e-mail that request(s) have been received and ask the Trust to confirm that it should be dealt with accordingly, leaving a more formal process to more unusual or sensitive cases. E-mail is not a secure medium, however, and care should be taken to ensure that adequate information can be exchanged without compromising the secure processing of highly confidential or sensitive personal data.

When a PoD determines that an exemption requiring a public interest test (PIT) applies it must send a copy of the request to the responsible authority. The responsible authority must carry out the PIT within a reasonable period of time, and inform the PoD whether the public interest requires that the exemption should be applied or not. The PoD must then inform the applicant of the decision. Although the Act does not specify a time limit for the PIT, it should take no more than a further 20 working days(^9).

The place of deposit must then tell the applicant whether it holds the information sought or not, and if it is withheld, explain which exemptions have been applied and why. In some cases, it may be appropriate to refuse to confirm or deny whether the information is held. (see section 6 below)

As transferred public records are involved, the place of deposit has 30 rather than the usual 20 days to respond to the applicant under The Freedom of Information (Time

(^8) [www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance_12_info_caught_by_foi_act.pdf](http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance_12_info_caught_by_foi_act.pdf)

(^9) [www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/foi_good_practice_guidance_4.pdf](http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/foi_good_practice_guidance_4.pdf) for Compliance with Request) Regulations 2004 (SI 2004 No. 3364) to allow time for consultation to take place.

3.4 Data Protection Act (s40 exemption)

For the purposes of DPA, the PoD is normally considered to be the data controller, with responsibility for responding to requests by data subjects for their personal data contained in public records.

However, other bodies may be also be considered data controllers in common where they process the same data in respect of their own specific statutory duties: for example, where an NHS body has temporarily recalled transferred records under s4(6) of PRA, it will be data controller in regard to any processing undertaken for NHS operational purposes, but it will not be data controller as regards decisions to destroy personal data contained in them, as destruction of transferred public records is a function reserved to the Lord Chancellor under PRA s6.

3.5 Determining the ‘responsible authority’

In the great majority of cases, the ‘responsible authority’ for information contained in records which have been transferred from an NHS body will be the body from which the transfer has been, or is being, received.(^{10})

However, in some cases, the transferring body may have ceased to exist since transfer (for example due to re-organisation or hospital closure), or legacy records may be transferring from premises not currently occupied by an NHS body carrying out the functions to which the records relate.

In such cases, the ‘responsible authority’ should normally be the NHS body currently providing the relevant functions in the area to which the records relate or dealing with the assets or people concerned. For example, if the records are those of a closed mental hospital, the trust or foundation trust currently providing mental health services in the area where the hospital was located should be the Responsible Authority.

Rarely, there may be more than one possible successor body because the function has been split or is exercised over a different geographical area.

The PoD should consult with the NHS bodies involved to establish which of them has the most appropriate knowledge and expertise to carry out PITs in respect of the matters to which the records relate. In case of difficulty the PoD should contact The National Archives, which in consultation with the Department of Health will secure a determination by the Lord Chancellor under section 15(5) of FOIA.

______________________________________________________________________

(^{10}) The Hosprec database: [www.nationalarchives.gov.uk/hospitalrecords/default.asp?source=ddmenu_search6](http://www.nationalarchives.gov.uk/hospitalrecords/default.asp?source=ddmenu_search6) provides useful background information on the administrative history of local NHS structures. 4 Establishing procedures for consultation

NHS bodies should already have contact with the PoD appointed to receive those of their records selected for permanent preservation. Where this is not the case, they should contact The National Archives:

ASD@nationalarchives.gsi.gov.uk

which will refer them to the appropriate institution (in most cases, this will be the local authority archive service for the area).

Places of deposit and the NHS body or bodies transferring records to them should establish local written agreements on consultation under s66 of the Freedom of Information Act. Where more than one PoD or NHS body, is involved, it may be appropriate to do this collectively rather than bilaterally. A summary should be publicly available (for example, on organisational websites).

The format of such agreements is for local decision, but a checklist of appropriate content is given as Appendix 1. They should be formally authorised and recorded, and be subject to periodic review.11

4.1 Places of deposit based in NHS Organisations

A few PoDs are located within NHS Trusts, and managed by seconded NHS staff, who may also carry out other roles within the Trust. It is important that the legal distinction between the functions of the PoD under PRA and the internal operational records functions of the Trust be maintained, and consultation processes documented in some way, even if these are effectively internal to the Trust.

4.2 Records already held for operational purposes

In some cases an NHS Trust and the governing authority of the PoD may have ongoing operational collaboration, for example in respect of the provision of care services or shared back-office functions, or local authorities running PoDs may hold records transferred from NHS bodies for operational public health and social care purposes.

Any issues regarding operational records management in relation to such records must be kept distinct from those relating to Public Records Act functions and PoDs must document the change in status of these records once they are being held for purposes of the Public Records Act even if the records do not physically move, as this will affect how statutory access decisions are made.

11 In some cases it may be possible to repurpose certain elements of existing corporate data sharing agreements. For guidance on information sharing generally, see: www.foi.gov.uk/sharing/toolkit/infosharing.htm 4.3 Consultation under Data Protection Act 1998

To avoid unnecessary duplication, the agreement should also cover procedures for identifying and seeking the opinion of the ‘appropriate health professional’ on requests by former patients for access to their own medical records, as required under Data Protection Act and para.6(2) of SI 2000/413: www.opsi.gov.uk/si/si2000/20000413.htm

This potentially limits the right of patients to access information relating to themselves contained in health records. Arrangements for consultation under this heading should take account of the extent to which such limits are likely to be applied in relation to the specific records transferred.

4.4 Sensitivity review on transfer

Irregular or unplanned transfers of substantial backlogs of records from Trusts to PoDs present significant risks of non-compliance with information legislation as records may be inappropriately destroyed or retained, or their whereabouts may not be documented.

Agreements on access procedures should therefore also consider processes for selection and transfer of records, and the authorising and recording of these processes so that both organisations can identify the existence and current location of records and discharge their respective legal responsibilities. Access agreements should also provide for the re-assessment of access conditions in respect of records transferred before 2005 where necessary.

5 Designation of records as ‘open’

5.1 General considerations

Since 2005, the duty to provide reasonable facilities for inspecting public records relates to records which ‘fall to be disclosed’ under FOIA. There are no statutory ‘closure periods’.

Records which contain no information to which a valid FOIA exemption can be applied should be considered ‘open’ records, and on transfer the PoD should provide facilities for public inspection, and copying in accordance with their duty under s5 of PRA, and any related guidance from The National Archives.

12 For selection generally, see: www.nationalarchives.gov.uk/information-management/projects-and-work/acquisition-disposition-strategy.htm www.dh.gov.uk/en/Publicationsandstatistics/Publications/PublicationsPolicyAndGuidance/DH_4131747 www.healtharchives.org/docs/hospital_case_records_2006_final_version.pdf Records which may or do contain information to which an exemption under FOIA should be applied are not subject to the PRA duty to provide facilities for public inspection.

However, some information within such records may be accessible to the public (for example, by the provision of redacted copies on request) whether through individual written (or in the case of EIR oral) request, or in accordance with the PoD’s publication scheme.(^{13})

The processing of individual requests incurs costs in terms of staff time and delay for requestors, which can be avoided if records are designated ‘open’ as soon as possible. In addition to consulting over individual access requests, PoDs and NHS Trusts will therefore also need to proactively assess whether transferring records contain, or may contain, any information to which a valid exemption applies.

Selection and transfer can take place at any time before records reach 30 years old(^ {14}), preferably as part of normal NHS administrative processes for records disposal.

If the Trust is satisfied that transferring records do not contain any information subject to an FOI exemption, they should designate them as ‘open records’, and this should be recorded in the transfer documentation sent to the PoD.

The PoD should make these records available for public inspection in accordance with PRA as soon as processing of the accession has been completed.

However, in many cases, at the time of transfer, records will either:

- be known to contain some exempt information, or:
- their exemption status of their contents will be unknown.

In the first case, the NHS Trust should notify the PoD of the known applicable exemptions (whether at record series or item level as appropriate), and the PoD should fix an appropriate date for review of the status of the records.

Otherwise, PoDs, in consultation with the NHS Trust, should carry out a brief initial high-level assessment to determine whether the records contain any information that may be subject to valid exemptions, and the likely nature of these.

Records should not be made available for public inspection until this review is carried out, and any catalogue entry should be marked to indicate the intended review date, and FOI processes for access before that date.

In the light of this, they should set a point at which a more detailed review should be carried out, then proceed as above. This preliminary assessment should take into

(^{13}) For general guidance on publications schemes and charging for access under them, see:

www.ico.gov.uk/upload/documents/library/freedom_of_information/practical_application/usingthedefinitiondocuments.pdf

www.justice.gov.uk/guidance/foi-procedural-fees.htm#Charging_a_fee_limit_exceeded

nationalarchives.gov.uk/documents/guidance_paid_research.pdf

(^{14}) unless the Trust needs to retain records longer for operational reasons under .3(4) of PRA account the costs of detailed review, the likelihood of it resulting in the records (or a significant portion of them) being designated ‘open’, the potential information risks attached to the records concerned and the likely level of public demand for access in the meantime.

For example, if an initial assessment of the minutes of a hospital medical committee shows that it was common practice to record significant medical information regarding identifiable patients, it is unlikely to be productive to review these in detail for several decades.

Subsequent review(s) may involve a more detailed level of consultation and examination of the records depending upon the nature of any information risks identified in the initial assessment. Where these are low at the point of review it will normally be sufficient to review an appropriate sample of the content, rather than the whole.

In some cases, the preliminary assessment may indicate that immediate review is appropriate. Depending upon the information content of the records, it may also be possible to fix a future date at which the records will be designated as open, even if this is not feasible at the point of review.

These reviews are also covered by s66 of FOIA even though no actual request for information is involved. The PoD must consult the NHS Trust, and the latter must carry out any PITs necessary. In this case, there are no statutory deadlines for response, but Trusts should aim to comply with these as far as possible. Procedures for conducting them should be included in consultation agreements.

5.2 Application of existing ‘closure’ periods

Records transfers before 2005 will not have taken FOIA into account. The dates at which record units were scheduled to be made open to public inspection will have been determined on the basis of the periods specified under PRA (30 or 100 years as appropriate) and the last date recorded on the record unit. These periods no longer have statutory force, and in principle, the public may access information from any record unit regardless of date.

Records can be ‘closed’ only in the sense that, if the place of deposit considers that an exemption may apply to some or all of their information content, it will require members of the public to access the records via a formal FOI request, which may in some cases be refused, or granted in part through the provision of redacted copies or summaries, rather than through normal access channels, such as routine inspection in the reading room.

Ideally, PoDs should conduct a review of records transferred before 2005 which have not yet reached the dates for opening set under the old access regime, to determine whether they contain information that is subject to one or more FOIA exemptions. If not they should be designated ‘open’ and made available for public inspection immediately. This review must be done in consultation with the transferring NHS body concerned, under s66 of FOIA.

More realistically, where capacity for such a review is limited, they should consider whether there are smaller subsets of existing ‘closed’ holdings that could usefully be reviewed (as per 5.1 above), such as those for which high levels of public enquiries are being received.

Where it is not possible to conduct a detailed access review of records they should be designated as ‘open records’ at the dates previously fixed under the old PRA legislation unless one or more of the factors for retrospective ‘closure’ listed below is known to apply..

Where a PoD has reviewed a record which is not currently ‘open’ in response to a specific access request under FOIA, and it contains no exempt information it should be designated an ‘open record’ regardless of date.

5.3 Retrospective ‘closure’ of records

Rarely, material may have been opened to the public under the pre-2005 access regime, which would not have been if the current statutory framework and working assumptions in this guidance had been applied at the time. However, FOIA has a presumption in favour of openness, and it would be perverse to apply exemptions in a way which unnecessarily removes currently open information from public access.

Open material should only be retrospectively withdrawn from public access in where there is a specific statutory duty to do so, or a clear and substantial risk that one of the adverse consequences which the exemptions are designed to cover will in fact occur, taking into account the age of the records, the length of time for which they have been in the public domain, and the likelihood of the same or similar information being otherwise in the public domain.

5.4 Updating public information about access

Whether they are able to carry out a review or not, PoDs should amend their catalogues, publicity materials, forms (both on-site and online) web sites and reading room notices as appropriate to draw the attention of the public to the fact that material previously referred to as ‘closed’ may nevertheless now potentially be accessible under the provisions of FOIA (and possibly other legislation including DPA and EIR). Any existing references to access procedures as they existed before 2005 should as far as practicable be deleted or amended accordingly. Notices should provide details of internal appeals procedures and contact information for the Information Commissioner.

6 Release of information to specific individuals other than under Freedom of Information Act

6.1 General considerations

The duty to provide public access to inspect records under s5(3) and (5) of the Public Records Act (as amended) applies only to those records which ‘fall to be disclosed in accordance with’ FOIA. Section 7 of this guidance provides working assumptions for use in assessing this in respect of NHS records. Nevertheless, there are circumstances where it is appropriate for places of deposit to release information to specific categories of individuals outside the terms of their duty to give access to the public in general under PRA and FOIA, either on practical grounds, or because other statutory provisions apply.

While consultation on these is not a requirement under s66 of FOIA, on practical grounds it will usually be sensible for PoDs and NHS Trust to consider these issues in parallel with the s66 process.

6.2 Release of Information under Data Protection Act 1998

The most common specific statutory duty to release information from NHS records will be that arising under Data Protection Act 1998, i.e. release of information (‘data’) about a person (‘the data subject’) to that person.

- This takes place under section 7 of the Data Protection Act, even if the applicant specifies FOIA in the request.
- The time limit for a substantive response in such cases is 40 calendar (not working) days.
- A set fee may be charged (normally £10, but in the case of manual health records £50), although many public authorities waive this.
- Where personal data (other than that specifically relating to a person’s health contained in a health record, as defined by s68 of DPA) is contained in unstructured manual filing systems, a more limited subset of DPA applies, and subject access requests under section 7 need not be complied with if the cost limit under fees regulations would be exceeded.

In some cases, an applicant may request a range of information, some of which constitutes his or her personal data, and some which does not. It should be made clear to the applicant that his or her own personal data is being supplied in accordance with DPA rather than FOIA. The s40(1) exemption removes the need to release of such information under FOIA.

Given the sensitivity of much personal data in transferred NHS records, and the lack of any ongoing contact with the data subject, PoDs should request reasonable evidence of identity from the applicant before responding, as permitted by s.7(3) of Data Protection Act. Applications may also be made by third parties (for example, relatives or solicitors) acting on behalf of the data subject, in which case PoDs must also take steps to satisfy themselves that that is in fact the case.

For example where the data subject lacks capacity, an application might be made on their behalf by a person able to demonstrate that they have a Lasting Power of Attorney registered with the Office of the Public Guardian.(^{15})

As far as possible, any s66 consultation agreement should align requirements for the provision of evidence of identity between the two organisations, bearing in mind that the passage of time may render some forms of evidence difficult for the data subject to provide.

(^{15}) For more information on this latter point see: [www.publicguardian.gov.uk/](http://www.publicguardian.gov.uk/) 6.3 Exemptions to access rights under Data Protection Act

There are a number of exemptions to s7 and the other data subject rights under DPA. The Data Protection (Subject Access Modification) (Health) Order 2000 (SI 2000/413) made under that section, enables personal health data to be withheld from data subjects if release would cause ‘serious harm to the physical or mental health or condition of the data subject or any other person’.

Article 6 of the Order requires those controlling health data, including PoDs, to consult the ‘appropriate health professional’ before considering whether release might cause ‘serious harm’, unless it is reasonable to suppose that the applicant already has knowledge of the information concerned (Article 6(2)). Note that this criterion is very similar to that used by the s38 exemption under FOIA.

Where this requires different consultation processes and lines of communication from those under s66 of FOIA these should be separately included in consultation agreements, along with any agreed working assumptions on the circumstances in which the PoD can reasonably suppose that the applicant has knowledge of the information concerned.

Where extensive categories of data can be readily identified as being very unlikely to cause ‘serious harm’, it may be appropriate for such agreements to include provision for regular ‘blanket’ medical opinions to be supplied to the place of deposit to that effect. Conversely, where an NHS organisation has identified that records may contain information involving a high risk of ‘serious harm’, the place of deposit should be informed of this at or before transfer, and specific procedures put in place for dealing with any subject access requests to these.

In many cases, it may be sufficient to obtain a written statement at six-monthly intervals from a relevant health professional within the transferring Trust(s) that subject access to specified categories or classes of transferred records will not cause serious harm, confining specific consultation to those cases, or classes of case, believed likely to pose problems..

Where personal information relating to other identifiable living persons is contained in the same file unit, this should not normally be released under Data Protection Act, unless it consists of incidental references to medical staff and there is no reason to suppose that their safety would be compromised by release (SI2000/413, s8), or it is otherwise reasonable under all the circumstances to do so (for example, the reference is clearly to something that the data subject already knows).

Note that unless this regulation, or one of the other exemptions contained in Part IV of DPA, applies, subject access rights under s7 of DPA will always have effect regardless of any other legal provision to the contrary, in accordance with s27(5) of DPA.

6.4 Release under other statutory provisions

As noted above, the statutory duty to release information regarding deceased patients under Access to Health Records Act 1990 ceases to have effect once transfer to a place of deposit has taken place (though see section 7.5.3 below).

A number of other statutes such as Police and Criminal Evidence Act 1984 or National Health Service Act 2006 contain provisions which may require the production of information to specified bodies in specific circumstances. If this arises in respect of the older records held by places of deposit, The National Archives can provide guidance as to the appropriate response.

6.5 Voluntary release of Information outside the terms of Freedom of Information Act

Freedom of Information Act is generally ‘applicant blind’. Information should only be released to one individual under the Act if it could be released to any individual who requests it. Moreover, release under the Act cannot be made subject to conditions (except in the sense that the applicant may be subject to other legal constraints).

However, there may be circumstances where the release of information to a specific person would be entirely proper, or could be rendered so if certain conditions were imposed, even though exemptions would apply if release was being considered in relation to the public in general under FOIA. This guidance cannot cover all such possible circumstances, but reference is made to some of the more common ones below.

Before 2005, this situation was normally covered by the process referred to as ‘privileged access’ and release to the specified individual took place entirely at the discretion of the organisation (in this case the NHS body) transferring the records concerned to the place of deposit. This often included the imposition of conditions (for example in terms of the onward transmission of the information to others).

If requested records cannot be made generally accessible, pods and NHS bodies should consider whether release outside FOI would be possible. Care must be taken to ensure that use of this option does not compromise the ability to protect the information in response to other requests for access, for example, by undermining the confidential status of information subject to the s41 exemption. and the reasons for the decision should be documented.

With this option, conditions on subsequent use of the information should be employed to ensure that it does not enter the public domain. Applicants should be required to sign an undertaking to abide by these conditions. It should be made clear that access is being provided only to the individual (or class of individuals) concerned.

7 Applying exemption: working assumptions

7.1 Background

PoDs must consider the application of exemptions in relation to individual requests for information contained in records which are not yet ‘open’ on a case by case basis. However, many requests for access to information in records which are not yet ‘open’ will fall into common categories.

This section offers working assumptions to assist PoDs and NHS organisations to agree in advance how they will approach the application of exemptions in these common scenarios, so that they can be dealt with as expeditiously as possible, confining the need for detailed discussion to unusual or difficult cases. It is good practice to cite all relevant exemptions when responding to access requests. This will not remove the requirement to respond to each individual request, or for consultation under s66, but will make it easier to produce a consistent and considered response to requests.

7.2 General assumptions

This guidance assumes that records have transferred to a place of deposit thirty years after active administrative use ceased. Where an NHS Trust has transferred records substantially earlier, this may modify some of these assumptions, and should be subject to close consultation with the place of deposit.

Most people will, at some point in their lives, receive treatment from the NHS, and the mere fact that someone has received unspecified care should not in itself normally be considered ‘medical information’.

However, in some cases, information that is in itself purely administrative may imply medical information about an individual that is sufficiently specific to require it to be treated as medical: When assessing whether this might be the case, PoDs should take account of whether the patient is known, or can be presumed to be, dead, as this will affect the application of DPA, and the nature of the condition or the information in relation to the patient’s expectation of confidentiality at the time. For example, a list of patients admitted to a general hospital conveys little information other than that they were ill, as most people are from time to time, whereas the same list in regard to an STD clinic would strongly imply that the person was suffering from a particular class of disease to which some social stigma may have attached at the time, and in respect of which their expectations of confidentiality will have been extremely high.

In practice several categories of information listed below may well be found within the same physical records: for example, general hospital administration minutes may contain significant medical references to an individual patient whose case is raising discussion about possible changes in hospital policy.

Individuals may not always be identifiable, even if named (for example, a reference to ‘John Smith’ of uncertain date). Conversely, even if not named in a given file unit, an individual may be identifiable by virtue of other information held by the PoD (for example a reference to ‘the patient in bed 57’ may be identifiable if there is a corresponding register of beds giving names and other identifying details) Where a specific FOI request is involved, account should also be taken of other ‘means that are likely to be used by a determined person with a particular reason to want to identify individuals’.

Where it is unknown whether an identifiable individual is still alive, PoDs may make the following assumptions:

- assume a lifespan of 100 years

______________________________________________________________________

16 (Information Commissioner’s Office in case FS50162459) 17 See ‘Code of Practice for archivists and records managers under Section 51(4) of the Data Protection Act 1998’: nationalarchives.gov.uk/documents/dp-code-of-practice.pdf • if the age of an adult data subject is not known, assume they were 16 at the time of recording

• if the age of a child data subject is not known, assume they were less than 1 at the time of recording

There may be further indications in the records: for example, where a woman is said to have recently given birth.

7.3 General administrative information

7.3.1 Scope

Any NHS records not covered by other parts of section 7: examples might include committee minutes, agendas and reports, general correspondence about the administration of the organisation, property and financial records.

7.3.2 Working assumption

Release. Records should normally be considered ‘open’ on transfer.

7.3.3 Exceptions

Some of these records may contain incidental references to identifiable patients, staff or other persons (see 7.4-7.10 below).

Where this is the case, the record unit should not be designated as ‘open’ until the incidental information is no longer covered by an exemption, but the majority of the information content may still be disclosed in response to a specific request, for example by the release of copies or summaries redacted in accordance with sections 7.4 to 7.10 below quoting the exemption at s40(2) and 3(b) or Regulation 12(3) and 13(5) (Personal Information) as appropriate.

If it is sufficiently localised within the file unit it may be possible to consider other options such as physical access to the open portion under close supervision, or temporary extraction from the file unit, if this is compatible with preservation requirements.

7.3.4 Discussion

Most NHS general administrative records which are transferred at 30 years old will not contain any exempt information, or exemptions will have ceased to apply under FOIA s63 including s32 (court proceedings, including inquests) s33 (audit) s36 (prejudice to conduct of public affairs) s42 (legal privilege) and s43 (commercial interests).

Even where records have been transferred a few years early, it is very likely that the passage of time will have strongly weighted the public interest against the use of these, and some of the other possible, exemptions such as s41 (actionable breach of confidence) and s43 (commercial interests).

7.4 Information about identifiable living patients

7.4.1 Scope

This heading includes the major series of patient medical files (where these are preserved) and other series with a patient focus, such as admission and discharge registers, but is not confined to purely medical information and may include, for example, files relating to individual patient complaints or litigation.

When responding to requests from third parties, PoDs need not make unusual efforts to determine whether the patient concerned is alive, but should give the applicant an opportunity to supply proof that the person concerned is deceased, either informally at an early stage, via a standard paragraph in enquiry forms, or after a formal decision to withhold access under FOIA. See section 7.2 above for presumption of death.

7.4.2 Working assumption

Records containing such information should not be declared ‘open records’ while the data subject is, or may be, still alive. See 7.5 and 7.6 for decisions on opening once the patient is, or may be presumed, dead.

Where such information relating to a specific patient is requested by a third party from records which are not yet ‘open’, the PoD should neither confirm nor deny that information is held about any particular patient, quoting s40 (2) and s40(5) (data protection) exemption and the s.41 (actionable breach of confidence) exemption.

Alternatively, if the request is primarily for environmental information (eg a request for information about patients treated for asbestosis) the PoD should quote EIR Regulations 12(3) and 13(5). Unlike other EIR exceptions, this does not require any consideration of the public interest.

Where such information occurs incidentally within a file unit which does not primarily relate to the particular patient the record may be designated as ‘open’ if:

- the information is unstructured by reference to individuals and
- does not include or strongly imply clearly sensitive personal data (for example, a specific diagnosis of medical condition) and
- does not relate to matters where the patient would have a strong expectation of confidence (for example, a general complaint about the state of cleanliness of the hospital would not, whereas a complaint about a specific effect of this on the patient’s treatment might.) and is unlikely to cause substantial damage or distress.

18 See for example:: www.ico.gov.uk/upload/documents/decisionnotices/2008/fs_50083381.pdf www.informationtribunal.gov.uk/Documents/decisions/MerseyTunnelDecision_website.pdf Otherwise, it should normally be redacted from copies or summaries supplied to the applicant quoting the exemptions above, and the record should not be designated as ‘open’.

7.4.3 Significant exceptions

Note that in all the following instances, any release of information will be made outside the provisions of Freedom of Information Act (or EIR), and will therefore be confined to the particular applicant concerned. The applicant should be informed that the information is being released on that basis. Such releases will not cause the records affected to be designated ‘open’.

7.4.3.1 Subject access requests

See section 6.2 above.

7.4.3.2 Reactivation for medical purposes

Under s4(6) of Public Records Act 1958, NHS bodies may request the temporary return of transferred records for operational purposes: rarely, it may be necessary for medical staff to have access to older information about a patient, for example in relation to a further episode of patient care.

In practice, it may be more appropriate to create a copy of the original record which can be added to the new current patient file. Such requests should be made via the usual consultation arrangements, which should include provision for verifying that the receiving NHS staff have appropriate cover under schedules 2 and 3 of DPA to process the personal data it contains.

7.4.3.3 Medical research

There are established procedures for authorising medical research within the NHS, and statutory support for this is provided through the National Information Governance Board under s251-2 of the National Health Service Act 2006, and the Control of Patient Information regulations. Places of Deposit should suggest that medical researchers use these processes whenever possible. Details are available at: www.nigb.nhs.uk/ecc

Note that this covers only medical research (although arguably that might extend into closely related areas such as social policy): other research purposes are not covered, and would need to establish some other basis for processing under schedule 3 of DPA, of which explicit consent is the most likely, or some form of anonymisation.

7.4.3.4 Records covering long time spans

Under the pre-2005 access regime, PoDs had discretion to give physical access to older pages within registers or files, provided they could do so without risk to entries less than 100 years old, and services may wish to consider this option where appropriate, as information should not normally be less accessible under FOIA. 7.4.3.5 Other cases

There may be other rare instances where third parties legitimately need access to patient information, but are unable to secure consent of the patient(s) concerned. These will require careful and detailed consultation between PoDs and NHS Trusts. In each case, a valid grounds for processing under schedule 3 of Data Protection Act 1998 will need to be identified, and release should be limited to the minimum information necessary. Reference should also be made to current NHS guidance on patient confidentiality.(^{19})

7.4.4 Discussion

7.4.4.1 Application of Data Protection Act 1998

Although not all NHS information relating to identifiable living patients constitutes ‘sensitive personal data’ as defined by Data Protection Act 1998, in an NHS context it may convey some degree of implied information about health, and should therefore be treated as such even when it does not technically satisfy the definition.

It is vital to the functioning of the NHS that it provides, and is seen to provide, exemplary protection for patient information, which should not be undermined by its engagement with the Public Records Act. This may mean that in some cases, the data protection exemption will apply to information of NHS origin which could be released in another context.

PoDs are public authorities, as they hold public records on behalf of the Lord Chancellor under the terms of their appointment, even if their parent body is not itself a public authority. Thus unstructured manual personal data held by a place of deposit is covered to a limited degree by Data Protection Act.

Sensitive personal data may lawfully be ‘processed’ (which term includes giving access) only if at least one condition in each of schedules 2 and 3 of Data Protection Act can be met. While the transfer of records containing sensitive personal data to a PoD under sections 3(1) and 4(1) of Public Records Act is covered by the s7 of Schedule 3 (‘the exercise of any functions conferred on any person by or under an enactment’) of Data Protection Act, this does not in itself provide a basis for providing access to such records to persons other than the data subject.

s.40(2) of FOIA provides an absolute exemption if release would contravene the Data Protection Principles, or could be exempt from access by the data subject under s7 (s40(4) exemption): and a qualified exemption if it would contravene s10 of DPA (s40(3) a), The release of structured data relating to living patients to the public in general will usually be prohibited by DPA, as it is very unlikely to be ‘fair and lawful’ and both of these conditions will usually apply. The s13(5) exception of EIR provides a parallel basis for withholding personal data: again, no public interest test is required.

(^{19}) This is currently to be found on the Department of Health website at: www.dh.gov.uk/en/Managingyourorganisation/Informationpolicy/Patientconfidentialityandcaldcottguardians/DH_4084181 By s33A of DPA as amended, unstructured personal data is exempt from all but the 4th and parts of the 6th Data Protection Principles, as well as other significant provisions. DPA may therefore not prohibit the release of such information in many cases. Nevertheless the FOIA s40(3)(b) exemption (and the corresponding EIR exception) enables such data to be withheld from third parties requesting it, and the sensitivity of information about NHS patients will normally make it appropriate to do so.

7.4.4.2 Law of confidence

The NHS and its staff also owe an equitable duty of confidentiality to patients in accordance with long-standing ethical and professional codes. Medical information is widely recognised as being particularly sensitive and confidential, and capable of causing substantial harm or distress to individuals if mishandled. In addition, the law of confidence has been significantly affected by Articles 8 and 10 of the European Convention on Human Rights, implemented in UK law through the Human Rights Act 1998 c.42. This effectively extends it to protect clearly ‘private’ information, such as information about health or family relationships, even if this has not been acquired directly from the patient by medical staff under a specific duty of confidence (for example, via observation or testing).20

While the s40 exemption will usually provide quite sufficient protection for patient information, it will also be appropriate to use the s41 exemption, as release to the public would normally involve a clear breach of the patient’s confidence that would be actionable in the courts. For further discussion of this exemption see 7.5.4.2 below).

7.4.4.3 No confirm/no deny

When using FOIA exemptions/EIR exceptions in respect of living patients (or in most cases, ex-patients) it is important that PoDs consistently neither confirm or deny that they hold information in relation to any particular patient. A standard response paragraph along the following lines should be used:

Blankshire Record Office holds certain historical records of NHS hospitals, as described in our published catalogues, including some records of former patients. Information regarding the health of living individuals is protected by the Data Protection Act 1998, and the duty of confidentiality owed by the NHS to patients in its care, and therefore in accordance with the exemptions at section 40 and 41 of the Freedom of Information Act, we cannot confirm or deny that we hold information regarding any individual, nor would we release such information to the general public if held. If you believe that there are reasons why information relating to an individual who might have been a patient may lawfully be released to you in particular, please supply further details.

This will avoid the risk that requestors may be able to draw limited inferences about patients from negative responses.

20 As noted by Lord Nicholls in Campbell v MGN [2004] UKHL 22: ‘The essence of the tort is better encapsulated now as misuse of private information. ..the touchstone of private life is whether in respect of the disclosed facts the person in question had a reasonable expectation of privacy’. 7.4.4.4 Incidental information

Unstructured patient information in records whose primary focus is on other matters is not subject to key elements of DPA. Nevertheless, the information can be withheld under FOIA, because s40(3) permits public authorities to treat unstructured personal data ‘as if’ it is structured, and fully subject to DPA. However, even if DPA applied, such information would not constitute sensitive personal data, and so could be processed – in this instance by being made accessible to the public – by reference to a DPA schedule 2 purpose only.

The purposes at 6(1) (‘necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed’) or 5(d) (‘other functions of a public nature exercised in the public interest by any person’) will normally apply to PoDs provided release does not cause ‘prejudice to the rights and freedoms or legitimate interests of the data subject’, which is very unlikely given the passage of time and the incidental nature of the information.

Where the patient is unlikely to have had high expectations of confidence at the time, and the information is several decades old, a breach of confidence is unlikely to be ‘actionable’ (see 7.5 below).

Use of this exception will avoid disproportionate obstruction to rights of access to information under FOIA and PRA merely because they contain trivial incidental references to individuals, in accordance with the general presumption of openness under FOIA.

Where more substantial references occur within records not primarily relating to patients, the records should not be designated as open: their access status should be scheduled for future review, at latest when the patients referred to can be presumed dead. Nevertheless, with the exception of the personal references, the other information on the file unit must be released on request by other means, such as the provision of redacted copies.

Under the pre-2005 access regime, PoDs had discretion to give physical access to older pages within registers or files, provided they could do so without risk to entries less than 100 years old, and services may wish to consider this option where appropriate, as information should not normally be less accessible under FOIA.

7.5 Medical information relating to identifiable deceased patients

7.5.1 Scope

Unlike the previous section, this section refers specifically to information relating to the diagnosis, care and treatment of identifiable patients, or details of private life otherwise obtained within the context of medical care (for example, references to sexual partners, or to internal family relationships) which the patient would have expected to remain confidential. Typically this would occur in records such as patient case notes, but possibly also in those administrative records which strongly imply information about a patient’s health (see 7.2 above). 7.5.2 Working assumption

This information should not be made accessible under Freedom of Information Act until the record unit is designated ‘open’. This will normally be at 100 years after the last date on the record (presuming the latter to be the most recent date on which care was received) - see 5.2 above.

The s41 exemption (actionable breach of confidence) should normally be quoted (other exemptions may apply in addition to this).

In the unlikely event that a request for such information falls under the Environmental Information Regulations (for example, a query concerning possible environmental health hazards), PoDs should consider redacting or withholding it under Regulation 12(5)(f) (interests of person providing the information). As with all EIR exceptions, the application of this is subject to a public interest test, carried out by the NHS Trust.

7.5.3 Exceptions

Access under FOIA or EIR may be considered where:

- the deceased patient was born more than 150 years ago, and:
- the information does not relate to a medical condition which is known to be strongly inherited or to be sexually transmitted, and:
- the information relates to matters likely to have been known or reasonably obvious to anyone having contact with the patient outside a medical context, and:
- the patient has not expressed a wish that the information should be treated as confidential.

Where a decision to release information is made, the record containing it may also be designated ‘open’ unless it also contains other information which should be withheld.

Access to information which is contained in records not yet ‘open’ should also normally be given to certain specific categories of person or organisation outside the terms of the Freedom of Information Act. Information necessary for the legitimate purposes of the applicant should be explicitly supplied in confidence in all these circumstances as follows:

- the patient’s surviving personal representative (if any) unless the patient is known to have expressly requested otherwise
- any person who may have a claim arising out of the patient’s death
- in certain circumstances, to close family of the deceased patient: (for details, see 7.5.4.8 below).
- for purposes of medical research, where statutory cover under s251-2 of the National Health Service Act 2006 is provided by the National Information Governance Board (see 7.4.3.3 above)
- the transferring NHS organisation.

There may also be other unusual circumstances in which access should be given, for example, to the police where necessary to the conduct of an ongoing criminal investigation. 7.5.4 Discussion

7.5.4.1 s40 (Data Protection)

Information falling under this heading would be defined as ‘sensitive personal data’ under s.2 of the Data Protection Act while the patient was alive. After death the exemption at s40 (Data Protection Act) and the corresponding exceptions at Regulations12(3) and 13(2)(a) of the Environmental Information Regulations can no longer be used to withhold access to such information.

7.5.4.2 The s.41 (actionable breach of confidence) exemption

However, it may still be possible and appropriate to apply the s41 exemption (actionable breach of confidence). Use of this exemption requires that:

- the information concerned must have been supplied by another person (s41(a)) and:
- disclosure to the public would constitute a breach of confidence actionable by that or any other person (s41(b)).

All NHS records received by a PoD under PRA will by definition have come from another person (in this case, another public authority), and will therefore meet the requirements of s41(a)21.

This is an absolute exemption, so no PIT under FOIA is required, although as an overriding public interest is one of the possible grounds for legitimately breaching confidence, a similar test is inherent in the exemption.

A successful action for breach normally requires that:

- The information must have the necessary quality of confidence
- Has been imparted in circumstances importing an obligation of confidence and
- There is unauthorised use detrimental to the party communicating it

In addition, a possible breach must be ‘actionable’ which in this context means that an action for breach, if brought, would be likely to succeed.22 This may also be dependent upon whether a breach could be defended as being in the public interest.

7.5.4.3 Who can bring an action

There is some limited case law to suggest that an obligation of confidence to the patient may continue to be enforceable by the patient’s personal representative

______________________________________________________________________

21 Even in the case of an NHS-based PoD, since the records are in legal terms ‘transferred’ from the NHS Trust to the PoD, acting for the Lord Chancellor.

22 [www.ico.gov.uk/upload/documents/decisionnotices/2006/101391_dn_rt_changes.pdf](http://www.ico.gov.uk/upload/documents/decisionnotices/2006/101391_dn_rt_changes.pdf) (specifically) after death. The s41 exemption (actionable breach of confidence) may therefore continue to be used, and will normally be the main basis for withholding deceased patient information (see 7.7 below for cases where a breach would be actionable otherwise than on behalf of the deceased patient).

Although the function of personal representative can in theory be passed on through multiple generations, various events such as intestacy can bring it to an end, and in practical terms, there will come a point when it is extremely unlikely that there is a specific person willing to act.

The Information Commissioner has taken the view that ‘it is sufficient for the purposes of section 41 if a suitable person or class of persons would be able to raise an action... even if in fact no living individual can be identified’, although this is untested in the courts. Places of deposit therefore need not locate such a person in order to use the exemption: however, they may reasonably take this factor into account when deciding whether a breach is in fact ‘actionable’.

7.5.4.4 Impact of the Convention rights on confidentiality

As noted in 7.4.4.2 above, these requirements must now be interpreted in accordance with the Convention rights under s 6(1) of the Human Rights Act 1998. They now cover personal information in respect of which an individual has a reasonable expectation of privacy, even where no confidential relationship exists between the parties, and the necessity for detriment is also removed, as a significant impact on personal privacy is in itself considered detrimental. The existing scope for confidentiality to be overridden where there is a significant public interest in doing so also now has to be interpreted in the context of the Convention rights.

The key Convention rights engaged are Articles 8 and 10. Article 8 gives public bodies, including the courts, a duty to ‘respect’ private and family life, homes and correspondence. Article 10 imposes a similar obligation not to interfere with the rights of individuals to impart and receive information, including rights granted by information legislation such as FOIA. Both Articles may be subject to limits, provided these limits are in accordance with the law and ‘necessary’ in a democratic society to achieve specified purposes.

Article 8 rights can be limited where necessary for purposes including the protection of health, or the rights and freedoms of others. Potential limits on Article 10 rights may include the protection of health or morals, the protection of the reputation or rights of others, and preventing disclosure of information received in confidence. In practice therefore, the rights and limits embodied in these two articles work reciprocally.

23 See for example the ruling of the Information Tribunal in EA/2006/0090: www.informationtribunal.gov.uk/Documents/decisions/mrspbluckvinformationcommissioner17sept07.pdf

For inheritance of the broader Convention right to enforce ‘respect for private and family life’ under Article 8 see, for example, Plon v France 58148/00): http://cmiskp.echr.coe.int/tkp197/view.asp?item=1&portal=hbkm&action=html&highlight=Plon%20%7C%20FRANCE&sessionid=58010990&skin=hudoc-en

24 In the Information Commissioner decision notice FS101391: www.ico.gov.uk/upload/documents/decisionnotices/2006/101391_dn_rt_changes.pdf Since both Articles are engaged, it is necessary to provide an appropriate balance between the two, taking account of the relative importance of the respective rights, and the justifications for applying any limit.

In interpreting FOIA and EIR in relation to current NHS medical information Article 8 will normally, though not always(^{25}), outweigh Article 10 as this is consistent with the permitted limits on the latter, notably the preservation of confidence, but also possibly the protection of health, as breaches in medical confidentiality may cause patients to be less open with medical staff, with a consequent impact on health care(^{26}). Both considerations relate to a ‘pressing social need.’ However, issues of proportionality must also be considered, and there may be instances where privacy rights can appropriately be overridden to protect public health (for example in investigations of medical negligence).

The inherent presumption of openness which FOIA embodies fits closely with Article 10 rights. Most relevant litigation tends to relate to the freedom of the press to report matters of public interest and hold public bodies to account. In an archival context, such issues are less likely to be of importance, as matters such as medical malpractice will usually (though not always) already have been resolved or rendered meaningless by the passage of time.

However, there remains a public interest in the ability to carry out historical research, broadly defined, to inform public knowledge and debate, as evidenced in the existence of legislation such as FOIA itself, the Public Records Act, the Local Government (Records) Act, s33 of the Data Protection Act, and in public funding for academic research. This has been recognised both by the European Court and by the Information Commissioner although it may not be regarded as particularly strong..(^{27})

Effectively, therefore when assessing whether the s41 exemption can and should be applied, it is necessary to assess under what circumstances protection of the ‘rights and freedoms of others’ under Article 10 will outweigh those in Article 8, or to express it conversely, the circumstances under which the imposition of limits on Article 10 can no longer be justified.

7.5.4.5 Default assumption

It has long been recognised that the passage of time will tend to erode the quality of

(^{25}) ‘Not every statement about a person’s health will carry the badge of confidentiality or risk doing harm to that person’s physical or moral integrity’ Baroness Hale in MGN v Campbell and ‘The law of privacy is not intended for the protection of the unduly sensitive’ Lord Goff in Attorney-General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109, 282

(^{26}) See (Z v Finland ) (1997) 25 EHRR 371 ‘It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.

(^{27}) ‘Access to original documentary sources for legitimate historical research is an essential element of the right to freedom of expression’ Kenedi v Hungary (31475/05). The Information Commissioner decided against release of information in, for example FS50132796 in respect of armed forces service records, and FS50163705 in a medical context, but this was essentially because the legitimate interest in research was outweighed by the fact that it was still relatively recent, and the availability of other sources made release less ‘necessary’. confidence. The extent of this erosion will depend upon the actual effect upon the adverse consequences that the obligation of confidence was designed to prevent.(^{28})

Clearly there can no longer be an ongoing direct effect on the patient him or herself in respect of privacy or reputation after death. Arguably however the possibility of release after death may have a prospective effect on the patient while alive. In practice, therefore, case law suggests that continuing maintenance of confidentiality is based upon the impact of release upon the feelings and attitudes of surviving family or associates in respect of the patient, although there is some ambiguity as to whether this is technically posthumous maintenance of the rights of the deceased, or maintenance of the Article 8 rights of surviving associates themselves in terms of their relations with the deceased. This corresponds with the ‘protection of the rights and freedoms of others’ limit on Article 10 rights.

The other major issue is the inherent public interest in protecting the legal principle of confidentiality in the medical context: This may be linked to the previous point, in that a fear of the prospective effects of release on family and friends, even after his or her own death, might increase the patient’s reluctance to be open with medical staff, while knowledge that release has occurred in respect of a deceased patient may affect the behaviours of other living patients. This corresponds with the ‘protection of health’ and ‘protection of information received in confidence’ limits on Article 10 rights.

There is little hard research or evidence on how the attitudes of patients or the public in general to medical confidentiality after death to inform decisions in respect of s41.(^{30})

In Plon v France, the European Court suggested that the impact on ‘the legitimate emotions of the deceased’s relatives’ of release would be very significant immediately after death, but might decline quite quickly thereafter to a point where ultimately public release would be justified. However, the case related to a public figure who had voluntarily placed certain medical information in the public domain, and where further information had also been extensively leaked to the press. Neither of these conditions is likely to apply to most cases dealt with by places of deposit, and there will clearly be variations depending upon specific circumstances.(^{32})

In the absence of specific evidence, the default policy is based on three key principles.

______________________________________________________________________

(^{28}) Attorney-General v Jonathan Cape Ltd [1975] 3WLR 606

(^{29}) It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general (Z v Finland) (1997) 25 EHRR 371.

(^{30}) Most studies on public attitudes relate to records of the living, but see for example, research carried out by IPSOS MORI for the Medical Research Council in 2007 (p20): www.mrc.ac.uk/Utilities/Documentrecord/index.htm?d=MRC003810

(^{31}) Editions Plon v France ECHR 58148/00: see http://echr.coe.int/echr/en/hudoc

(^{32}) For example, the Royal College of Psychiatrists suggests that the grieving process may normally last for about two years, but there are clearly exceptions: www.rcpsych.ac.uk/mentalhealthinfoforall/problems/bereavement/bereavement.aspx Firstly, in so far as the patient’s attitudes to release can be presumed to be based on the prospective impact on surviving family and associates, it cannot be affected by persons who are not in existence at the time of the relevant care episode, or anything which may happen after the latter have themselves died.

Secondly, the intention of Freedom of Information Act 2000 was to increase the accountability of public authorities, rather than to significantly increase access to private information relating to deceased individuals. On the other hand, the intent of the legislation was clearly not to reduce existing levels of access to information.

This suggests that major changes to rights of access as they existed before 2005 would probably not be justified. For that reason, this guidance suggests maintaining the pre-2005 100-year period from the last date on the record as a default for the general ‘opening’ of the physical file unit. Since this was the general statutory position from 1958 onwards, both NHS Trusts and patients will (in so far as they considered the matter) have expected confidentiality to persist over that time period in relation to access by the general public.

The elapse of this period will also ensure that the patient concerned is in fact dead, and that there is little likelihood of significant impact on their family and associates, either because the latter are also dead, or because the illness and treatment concerned took place many years ago.

For the same reasons, as before 2005, where a file unit relates to more than one patient, information more than 100 years old within the file should be releasable, either through the use of redacted copies, or physical access subject to the type of security measures suggested.

7.5.4.6 Environmental information regulations

Rarely, places of deposit may receive requests for deceased patient information that fall under the heading of environmental information. Here an explicit PIT is involved. The exception at Regulation 12(5) (f) may apply where the information has been supplied voluntarily by the patient, directly or indirectly, this is subject to a public interest test, carried out by the NHS Trust. There may be some difficulty in using this exception where the patient has been treated involuntarily (for example, under the Mental Health Acts), although in this case it might be argued that the state is acting voluntarily on the patient’s behalf while the latter is unable to do so.

There will be a very strong public interest in applying this exception where medical information is concerned, in terms both of protecting the principle of personal privacy and confidentiality (in Art.8 terms) and of enabling the NHS to function. Arguably, if patients suffering from environmentally-related diseases were deterred from treatment by the fear of release of information, it might even subvert the purpose of environmental protection that the Regulations are designed to support.

However, where there are genuinely significant environmental health issues involved, these may well fall within the purposes of public safety and protection of health, and possibly prevention of crime, specifically recognised by Article 8 as providing possible exceptions to the general right of respect for private life, and therefore constitute an exceptional case where release is justified.

7.5.4.7 Exceptions: possible earlier access under FOIA

The approach with regard to the s41 exemption laid out above may be disproportionate and unnecessary in terms of the convention rights in some circumstances. In particular, the different bases of the pre-2005 access provisions of PRA and FOIA could result in access to records relating to routine care for persons long deceased being unnecessarily withheld.

- Where patients were born more than 150 years ago, there is no significant probability that immediate descendants will be alive, and very little that members of a younger generation known to the patient will be. In most cases therefore, the passage of time will rule out any significant impact on living individuals, or divergence from the expectations of confidentiality of the deceased while still alive and receiving treatment.

- The remaining additional conditions are intended to deal with the few remaining instances where some impact is still possible, both in terms of individuals and in terms of public confidence in medical confidentiality.

- Many common medical conditions have a genetic component, but this will not normally be sufficient to make significant inferences about persons other than immediate descendants (beyond those available from public sources such as death registration). Where a genetic component is sufficiently strong to draw such inferences about subsequent generations who are still alive (for example, Huntington’s disease) release to the public in general in advance of the default option would not be appropriate.

- Sexually transmitted illness has been recognised as particularly likely to carry stigma for patients, and is the subject of specific legal protection within the NHS.

- In many cases, a patient’s medical condition will have been either physically obvious (for example, a broken leg), or regarded by the patient as so trivial (a cold) that it will have been known to wider social contacts as well as close family. While medical confidentiality would still apply at the time, the quality of confidence in such information it would decline much more rapidly after the patient’s death, as the patient’s expectations of confidentiality and the potential additional impact of release on others will have been much lower.

- For the same reasons, release is unlikely to have significant prospective effect on current patients’ trust in medical confidentiality.

- Nevertheless, patients have different degrees of expectations of confidence, and where a patient has expressed wishes in this regard, whether generally, or as regards specific persons, these should be respected, both on their own account, and to maintain trust in the principle of medical confidentiality among current patients.

- The approach outlined here should only be adopted after a thorough assessment of the records in consultation between the Trust and the PoD, and where there is whether the specified conditions apply or not, early release should not take place.

7.5.4.8 Exceptions: access outside FOIA

See 6.1 above for general principles of release outside FOIA.

- The first two exceptions listed at 7.5.3 are based upon the rights of specified persons created by Access to Health Records Act 1990.

- While the Act does not apply to records held by places of deposit, it embodies

______________________________________________________________________

33 NHS Trusts and Primary Care Trusts (Sexually Transmitted Diseases) Directions 2000: www.dh.gov.uk/en/Publicationsandstatistics/Publications/PublicationsLegislation/DH_408302

7. The corresponding 1991 Directions continue to apply in Wales. a public interest that should be sufficiently strong to justify breach of confidence in releasing information to the specified classes of persons, and it would be manifestly unfair if they were deprived of effective access by legal technicalities consequent upon the transfer of records to a place of deposit. The basis for such disclosure in Article 8 terms would be ‘the protection of the rights and freedoms of others’.

- Moreover, if the personal representative of a deceased patient has standing to bring an action for breach of confidence, it seems unlikely that a breach would be ‘actionable’ if they themselves are applying for access and hence have no intention of bringing such an action (unless a third party would have grounds to bring an action on their own behalf, see 7.7 below).

- Where substantial periods of time have elapsed since death PoDs should exercise reasonable flexibility in requiring evidence that the applicant belongs to these classes of persons. After several decades, if the applicant can produce evidence that they might be a person with a plausible claim to be the personal representative, and is willing to give an undertaking that this is the case, that should be sufficient unless there is reason to suspect the contrary.

- Note however that a personal representative cannot force disclosure to other specific persons, they can only remove one possible ground for withholding access to the general public under FOIA. However, his or her support for such disclosure outside FOIA would be a significant factor in favour of that course.

- Where the deceased patient has specifically requested that no information should be released to the personal representative and no other exemption can be applied the NHS Trust might consider whether it would have sufficient standing to bring an action for breach of confidence on its own behalf. Note however that as the Trust is not a private individual, it may be limited to protecting information specifically obtained via a confidential relationship with the patient.

- Applications for information regarding deceased patients are most likely to come from close associates or the family of the patient. Where requests come from family members other than a personal representative, a number of factors should be considered with regard to access.

- The grounds for access by close family member(s) would be the positive duty of a public authority under Article 8 to respect the private and family life of the applicant(s) in relation to the deceased patient by the provision of necessary information. This is likely to be stronger than the broader, but shallower, general public interest in research and accountability which is the primary focus of FOIA and PRA.

______________________________________________________________________

34 See Information Tribunal case EA/2006/0090: www.informationtribunal.gov.uk/Documents/decisions/mrspbluckvinformationcommissioner17sept07.pdf

35 ‘Although the object of Article 8 is essentially that of protecting the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in effective respect for private or family life. In determining whether or not such a positive obligation exists, the Court will have regard to the fair balance that has to be struck between the general interest of the community and the competing interests of the individual, or individuals, concerned’ (ECHR Ginley and Egan v UK 21825/93 and 23414/94): • Medical records may well contain information relevant, for example, to the safeguarding of family members’ own health, to the establishment of family relationships (for example where there has been disputed parentage or family breakup following mental illness) or to the understanding of family circumstances.

• The definition of ‘close family member’ in this context will clearly extend to spouses, parents, grandparents, uncles/aunts and siblings but may include step-family, or even non-relatives where there is evidence of close ‘family’ ties. For the first group, relevant civil registration certificates should suffice as evidence of relationship, but for others, it may be necessary to require the applicant to give a fuller demonstration of close family ties. Again, the passage of time may require some flexibility.

• This right must be balanced against the general public interest in maintaining medical confidentiality, as well as any known potential competing Article.8 rights of other private individuals in relation to information about the deceased.

• If a surviving personal representative exists and objects, or is thought likely to object, or if the records contain an express or strongly implied wish of the patient that information should not be disclosed, it can be assumed that disclosure would be ‘actionable’ and the exemption at s41 will therefore also stand. unless there is some other very strong public interest to the contrary, for example if the records contain evidence of a treatable hereditary condition.

• Clearly, consultation with an appropriate clinician at the NHS Trust will be necessary when considering medical reasons for disclosure, to ensure that this has the intended beneficial results and that any possible harm is minimised. The basis for such disclosure in relation to Article 8 would be the public interest in ‘the protection of health’.

• It is unlikely that places of deposit will reasonably be able to seek the views of other family members given the passage of time. However, if they are aware that another close family member or the personal representative is likely to object then care is needed and the disagreement either needs to be resolved, or the reasons for it need to be explored to see if some partial release is feasible. If a known or probable personal representative agrees release, their views carry particular weight in the case of any disagreement, but is not conclusive in terms of release outside FOIA.

• If there is reason to believe (on the basis of the content of the records and other available sources) that no other relevant parties survive it seems

______________________________________________________________________

36 ECHR 10454/83 In Gaskin v UK, which concerned access to records of upbringing in state care, the court established that people ‘have a vital interest, protected by the Convention, in receiving the information necessary to know and to understand their childhood and early development... the interests of the individual seeking access to records relating to his private and family life must be secured when a contributor to the records either is not available or improperly refuses consent.’

37 ECHR Marckx v Belgium 6833/74

38 ECHR Keegan v Ireland 16969/90

39 See General Medical Council guidance at: www.gmc-uk.org/guidance/ethical_guidance/confidentiality.asp unlikely that there would grounds to withhold.\\textsuperscript{40}

- In cases of uncertainty, it may also be helpful to consider the nature of the medical or private information itself, as noted above.
- For return to the Trust, see 7.4.3.2 above: in this case use will usually be for legal or administrative rather than medical purposes.
- For medical research access, see 7.4.3.3 above: note that there may be a ‘fast track’ process for access to records of deceased patients.

7.6 Administrative information relating to identifiable deceased patients

7.6.1 Scope This section refers to information which was recorded for the purpose of organising care for a patient who is known to be, or can be assumed to be dead [see 7.2 above] but which does not contain specific medical information or confidential information relating to private life. Examples would include records of dates of treatment, or inventories of a patient’s property.

7.6.2 Working assumption Information of this type should be released. If no other exemptions or exceptions apply to information within the physical file unit, this should be designated ‘open’.

7.6.3 Exceptions

- Where the context in which this information is recorded implies a significant degree of information about the nature of the patient’s condition or treatment, even though this falls short of the detailed information covered in section 7.5 such information should be dealt with as if it were medical information in accordance with the that section.
- For example, an inventory of property contains no medical information per se, but if it is among the records of a mental hospital, it implies that the patient has been treated for some form of mental illness whereas similar records in a general hospital would normally not carry any such implication.
- It is unlikely that a request specifically for such information would fall under the Environmental Information Regulations: however, on the rare occasions this applies, PoDs should consider withholding it under Regulation 12(5)(f) (interests of person providing the information). As with all EIR exceptions, the application of this is subject to a public interest test, carried out by the NHS Trust.

7.6.4 Discussion

- Information concerning patients is no longer covered by Data Protection Act once they are dead. The s40 exemption is therefore no longer applicable.

\\textsuperscript{40} In Grass-Russo v Nugent [(2001] EWHC Admin 566; [2002] 1 FLR 1, which concerned information regarding natural and adoptive parents as well as the applicant adoptee herself), the court took the view that, while in principle confidentiality in relation to these could outweigh the applicant’s right of access, it was clear that the other persons named were all now dead, and there were no other persons who would obviously be adversely affected by release. • However, as discussed in section 7.5 above, the s41 exemption, and the corresponding EIR exception 12(5)(f)) can still apply after the death of the patient concerned and places of deposit and NHS Trusts must look at the balance of factors involved to determine whether the exemption should be applied.

• During a patient’s lifetime, the NHS normally treats all personal information recorded in the context of ongoing care as confidential, not just that which is specifically medical. However, the degree of confidentiality may vary depending upon the nature of the information, and NHS confidentiality guidance recognises, for example, that in some circumstances it may be appropriate to confirm in response to a media enquiry the bare information that a particular patient is currently receiving treatment. If this was true at the time, while the patient was alive, it will be more so after the patient’s death.

• Some of this information will either effectively have been in the public domain (for example, details of address or phone number will often have been widely available through electoral registers or phone directories), or at least will have been known at the time to persons other than the patient and the NHS staff treating him or her (for example occupation). While this would not necessarily prevent it being confidential at the time, the patient’s expectation of confidence will therefore have been somewhat lower than in respect of strictly medical information, or other personal information obtained in the context of the patient-doctor relationship. For this reason, release of such information is unlikely to undermine protection of the principle of medical confidentiality.

• The passage of time can therefore be expected to erode any remaining quality of confidence in such information relatively quickly once the patient has died, and records transferred to a place of deposit will normally be at least thirty years old. For any implications in respect of third parties, see section 7.7.

• Even where residual confidentiality remains, this has to be weighed against the general public interest in access to information contained in public records [see 7.5.4.4 above]. In most cases within scope of this section, it will be disproportionate to use the s41 exemption to limit this right, given that the person to whom the information relates is dead and can no longer be directly affected by release.

• In some cases, however, the context may imply some degree of medical information about a patient, even though no specifically medical information is recorded, and the recorded information itself is relatively innocuous and not particularly private. Access decisions should therefore be made in relation to the implied information rather than the information actually recorded, in accordance with the working assumption relating to private and medical information in 7.5. In some cases, it may be necessary to refer to information in other related records in order to assess some of the factors referred to in 7.5.

7.7 Incidental references to patient family etc administrative information

7.7.1 Scope

Information of an administrative nature relating to patients’ families, friends, colleagues and other personal contacts (for example, contact details of next of kin, references to visits etc). This will not normally be the main focus of the record. 7.7.2 Working assumption

This information should normally be released.

If no other information in the physical file unit involved is covered by an exemption or exception, the file unit should be designated ‘open’.

7.7.3 Exceptions

- the information falls within the definition of ‘sensitive personal data’ in Data Protection Act or:

- the record specifically states that the particular item of information is considered to be confidential, and the grounds for that statement have not clearly ceased to exist; or the context suggests that there are circumstances which may require it to be treated as confidential, and:

- the individual is, or could still be, alive

- PoDs should consider whether to redact or withhold, quoting the exemption at s40(2) and 3(b) or EIR exceptions at Regulation 12(3) and 13(5) (Personal Information) as appropriate. It may also be appropriate to use the exemption at s41 (actionable breach of confidence) or, if the request was essentially in respect of environmental information, the exception at EIR Regulation 12(5)(f) (interests of person providing the information). In this case, the record containing the information should not be designated as ‘open’ until the person concerned is, or can be presumed to be, dead or until the reasons for confidentiality have clearly ceased to apply, whichever is sooner.

- If the context suggests that release may endanger a living person (for example, release of an address where the record suggests domestic violence affecting a family) PoDs should consider redacting or withholding using the exemption at s38 (health and safety): in this case, the NHS Trust must carry out the necessary public interest test. However, note the relatively high threshold for application of this exemption.

7.7.4 Discussion

In the great majority of cases, this type of information will either be relatively trivial (for example notes of visits) or to some extent in the public domain (contact details, the fact of relationship). Given that the information is over 30 years old, this is unlikely to have significant sensitivity, or impact on the persons concerned if released, even if they are still alive.

The exceptions relate to cases where such impact is possible even after that length of time (for example, information that the person concerned was in prison at the time, or that they had asked for their address details not to be supplied to the patient or other family members).

In these circumstances, while Data Protection Act may not technically require unstructured personal information (which will form the majority of this type of information) to be withheld, it will often be appropriate to do so, as it would be unfair or unlawful to release it if it related to structured personal data. Given the essentially private nature of the information, it will also be feasible to use the s41 exemption, regardless of whether the information was supplied in confidence or not.

Where the original reason for withholding information other than sensitive personal data has ceased to apply, it will no longer have the necessary quality of confidence, nor is it unlikely to be unfair or unlawful to withhold it.

However, once the person concerned is or can be presumed dead, there will rarely be reason to withhold such information, as Data Protection Act will have ceased to apply, and there can no longer be any direct effect on them of release, so the information is unlikely to retain the necessary quality of confidence.

7.8 Patient family personal or medical information

7.8.1 Scope

Information of a personal or medical nature relating to patients’ families, friends, colleagues and other personal contacts (for example, information as to state of health or personal relationships supplied by the patient in the course of medical treatment, but excluding the mere fact of relationship, unless this was not likely to have been in the public domain through civil registration etc)

7.8.2 Working assumption

Where this relates to identifiable individuals who are, or may still be, living, it should be redacted or withheld, quoting the exemption at s40(2) and 40(3), or the EIR exception at Regulations 12(3) and 13(5) as appropriate, unless it is information which is in the public domain.

In so far as the information relates to applicants themselves, it should normally be supplied to them under the terms of Data Protection Act unless it is contained in a record relating to a patient who is, or may still be, alive, in which case reference should be made to the Information Commissioner’s guidance on shared personal information:

http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/sar_and_third_party_information_100807.pdf

Where this relates to identifiable individuals who are, or can be assumed to be, dead, it should normally be redacted or withheld in the same way as deceased patient medical information [see 7.4], quoting the section 41 exemption (actionable breach of confidence) or EIR Regulation12(5)(f) (interests of person providing the information). As with all EIR exceptions, the application of these is subject to a public interest test, which must be carried out by the NHS Trust.

7.8.3 Exceptions:

Where any such information is less than 100 years old and release is likely to endanger the physical or mental health of any living individual consideration should also be given to redacting or withholding it under the s38 exemption or the EIR exception under Regulation 12(5)(a). 7.8.4 Discussion

Even where information of this nature does not fall within any of the specific categories of sensitive personal data, it is inherently worthy of protection in accordance with the duty to respect private and family life under Article 8 of the European Convention, and in most cases is likely to have been acquired by NHS bodies in the context of a confidential medical relationship.

As noted in 7.4.4.1, although Data Protection Act does not absolutely require unstructured personal data to be withheld, it can be, using s40(3) (and the EIR equivalent) while the person concerned is alive.

If the information relates to the applicant, it would normally be disclosed to him or her as required by Data Protection Act s7. However, in a health context it may well be intermixed in the same file unit as sensitive information relating to a patient or other persons, and particular care is therefore needed to ensure that significant information regarding these other persons is not released as a consequence, as discussed in more detail in the ICO guidance referred to. Also, as with information relating to the patient, in so far as such information relates to the health of the applicant (for example, reference in a discussion of mental health issues within the patient's family) the Data Protection (Subject Access Modifications) Order 2000 may potentially apply.

When the information relates to a person who is deceased, it will normally still be feasible to withhold it using s41 as being of an inherently private or confidential nature, given recent developments in the law of confidence.

In addition to the inherent public interest in protecting privacy in accordance with Article 8, there is a further strong public interest in the NHS protecting, and being seen to protect, information supplied to it with an expectation of confidence, even if it does not directly relate to an NHS patient. While the quality of confidence will tend to decline with the passage of time, these specific public interests will normally be sufficient to outweigh the general public interest in research for some considerable time, in the same way as patient-related medical information.

7.9 Information relating to NHS staff

7.9.1 Scope

This covers information substantially focused on individually identifiable members of NHS Staff or former members of staff who are currently, or can be presumed to be currently alive. Typically this would include personnel/ staff files or registers. Information relating to groups of staff falls under the administrative records heading

7.9.2 Working assumption

Information relating to the day to day working of staff (eg duty rosters or incidental references in patient files etc) should be released, and if no other exempt information is on the file unit, it should be designated as 'open'. 7.9.3 Exceptions

Information relating to:

- personal or family circumstances
- disciplinary matters
- likely to raise significant risk of fraud or ID theft
- matters where the context suggests that the safety of any one may be placed at risk by the release of such information

should be withheld until the staff members concerned are, or can be presumed to be, deceased [see 7.2]. Records containing such information should not be designated as 'open', and it should be redacted where information is supplied from records not yet open in response to a request. The exemptions at s40 (2) and s41 (or EIR exceptions at Regulation 12(3) and 13(5) (Personal Information) should be quoted in the first two cases.

s31(a) (prevention or detection of crime) may also be quoted in the third case.

s38 (health and safety) may be quoted in the fourth case.

7.9.4 Discussion

In a number of cases, the Information Commissioner has ruled that incidental information about NHS staff acting in the course of their normal day to day duties should be released, as it does not relate to them in any significantly personal way and therefore use of the s40 exemption is not appropriate. Most NHS staff operate to some degree in public-facing roles, and would expect this level of information to be known by people beyond their own colleagues.

S.7(4) of Data Protection Act makes specific provision for such incidental references to be released in response to subject access requests.

Given that transferred public records will be at least thirty years old, most staff information will have no bearing on current circumstances, and most staff referred to will in any case have left NHS service. These assumptions may not apply where Human Resources records focused on staff are involved.

Information about the personal or family circumstances of staff which would not have been known outside their immediate circle or beyond NHS line management or the HR department will be subject to many of the same considerations as similarly private information relating to patients and their families, in that it will attract the protection of Article 8, even if not technically 'sensitive' personal data.

Similarly, certain employee information such as National Insurance Numbers (NINO's) although not 'sensitive' could potentially be misused for purposes of fraud which would directly impact on the employee or former employee concerned. Release of such information would be 'unfair' in terms of Data Protection Act, and will also usually have been supplied in the expectation of confidence. Although ID theft involving deceased persons is an issue, there is no direct impact on the individual staff member concerned once they are dead, and there are likely to be many more current risks than older employment records. Disciplinary cases are likely to have been processed with at least an implicit expectation of confidence on the part of the employee. While there may be cases where there is a substantial public interest in the process (for example, where a patient has suffered harm as a result of employee negligence) there will usually have been some output from an investigatory process which will be in the public domain, and hence reduce the public interest in a breach of confidentiality.

Occasionally, for example, due to mental illness or a serious breakdown of relations between a patient or their family and NHS staff, the latter may be at some risk of harm if information about them is released. Where there is specific evidence of this in the records, it may be appropriate to withhold access using the s38 exemption, despite the significant lapse of time. However, note that the level of risk required to engage this exemption is quite high, and that a PIT by the NHS Trust is required.

7.10 Information relating to other identifiable persons having dealings with the NHS

7.10.1 Scope

This could include persons supplying goods or services to the NHS (for example, correspondence about the supply of goods and services); contacts with other public services outside the NHS (for example local authority or police staff); or members of the public having contact with the NHS eg making general enquiries or complaints about NHS activities or services, responding to NHS consultations etc.

7.10.2 Working assumption

Release. Where no other information subject to an exemption or exception is contained in the record, it should be designated ‘open’.

7.10.3 Exceptions

Where the information constitutes sensitive personal data (for example, regarding possible criminal activity) and the person(s) concerned are, or may still be, alive information may in some cases appropriately be withheld. The exemption at s40(2) and 40(3) or EIR exceptions at Regulation 12(3) and 13(5) (Personal Information) should be quoted as appropriate if substantial damage or substantial distress is likely to result from release.

7.10.4 Discussion

While the information may have been supplied in confidence at the time (and been marked as such) and therefore would have potentially attracted the exemptions at s41 (actionable breach of confidence) or s43 (commercial confidentiality) the passage of time (at least 30 years) will normally have reduced the quality of

41 Where staff members are, or are likely to still be alive, the exemption at s.40(2) is also likely to apply, see for example: www.ico.gov.uk/upload/documents/decisionnotices/2007/fs_50090630.pdf confidence to the point where it has either ceased to exist altogether, or is outweighed by the general public interest in research.

Even where the individual concerned is or may still be alive, the information will usually be subject to the provisions of the Data Protection Act only by virtue of s1(e) (unstructured manual personal data held by a public authority), which effectively limits application of the Act to a very limited subset of the provisions.

The Act is therefore very unlikely in itself to prevent release of such information, even if it is possible to withhold or redact such information using the s40 (3)(b) exemption of FOIA (or the equivalent exception in EIR’s). as it is also unlikely that release will be unfair or unlawful.

The exception relates to those cases where such information consists of sensitive personal data (for example, that information exchanged with the police on a security incident refers to a criminal conviction of a person involved)

It is also possible consider use of the s41 exemption if the information was explicitly acquired on a confidential basis, or is of such a nature that an implicit duty of confidentiality may have been considered to exist, regardless of whether the person concerned is still alive or not. As discussed above, recent developments in the law of confidentiality may lead to such a duty arising even where there the information has been acquired outside the scope of a confidential relationship between the parties concerned.

However, in either case, the place of deposit should consider whether the circumstances that made the information sensitive or confidential continue to apply. For example, a note that a relative is not coming to visit the patient as arranged because the relative is suffering from a cold is technically sensitive personal data if the relative is still alive, but the trivial and transitory nature of the circumstances mean that redaction or withholding would be unnecessary, if not absolutely required by the Data Protection Act.

Places of deposit should therefore not redact or withhold the information unless release is still likely to cause substantial damage or substantial distress. This will enable them to designate many more physical file units as ‘open’.

8 Further information

This guidance can cover only the more common circumstances regarding the release of NHS records. Where Places of Deposit and NHS Trusts cannot resolve more difficult or unusual cases locally, they are welcome to contact Archives Sector Development at The National Archives:

The National Archives Kew Richmond Surrey TW9 4DU

ASD@nationalarchives.gsi.gov.uk

020 8876 3444x2635 9 Appendix 1: Checklist for Consultation Agreements

9.1 Who should be Involved

- The officer appointed by the Lord Chancellor to manage the place of deposit under section 4(5) of the Public Records Act.
- The officer(s) responsible for the operation of Freedom of Information Act and Data Protection Act in the PoD (or its parent authority).
- The officer responsible for patient records management in the NHS body (or bodies).
- The officer responsible for other records management in the NHS body (or bodies).
- The Caldicott Guardian in the NHS body (or bodies).
- The officer(s) responsible for the operation of Freedom of Information Act and Data Protection Act in the NHS body (or bodies).
- Appropriate authorising parties.

In some cases these roles may not exist, or it may not be necessary for them to be involved in detailed drafting.

9.2 Content of the Agreement

The Agreement should specify:

- the parties
- the statutory background
- the scope of the records covered
- the normal points of contact in each organisation, including arrangements for dealing with unexpected staff absence or turnover;
- roles and responsibilities
- agreed timescales for communications between the parties during the various stages of the consultation process (taking account of the fact that these may need to vary depending upon the specific legislation engaged)
- working assumptions (reference may be made to this guidance, as well as any local variations which may be necessary, and the reasoning behind these)
- processes for handling appeals and references to the Information Commissioner • processes for recording consultation actions;

• the form of communication (which may vary from case to case, depending upon the sensitivity of the information which needs to be communicated in order to consult effectively).

• transfer processes, including those for access review on transfer

• links to other relevant policies and guidance

• authorisation and processes for periodic review.